So your attempting a active connection there - your telling the client to connect to

PORT 84,21,xx,xx,192,13

I snipped out part of that IP, because of privacy concerns - I would suggest you edit that. Anyway you told the server to connect to that IP on port

192*256 + 13 = 49165, since your control channel is inside a encrypted connection (ssl/tls) the helper portion of most firewalls/routers can not open the return port for you.

Also from thisjasonw (84.21.xx.xx)> disconnected

where that is the same IP as your server? Are you attempting this from a loopback forward/nat reflection, ie are you on the same network as your server -- which I would assume is behind a nat? Maybe not? That can cause grief as well. And using the public ip of your router to try and connect where your router wold have to forward/reflect the traffic back into the servers private IP?

So questions for you - is your server behind a nat and really on a private IP? And this 84.21 is your public? Where is your client? is it outside your local network?

This goes over the difference between active and passive connections - which you need to know what your going to be using or allowing, etc. And you need to understand if your firewall/router has helper feature to change private to pubic, and allow the return data channel traffic in the firewall states, etc.

After the day I am having I can fully believe I did that too (left IP in there), unfortunately I cant edit my previous post so will ask a mod to.

84.21.*.* is the client external IP, the server IP is 194.88.*.*

The server is behind Sonicwall NSA2400`s running in a High availability set up, apparently it is one range inside and one range out, they are 2 devices running in HA mode for resilience so one is effectively in standby. They share an IP inside and out and virtual MAC address, We are going to temporarily fully open the ports tomorrow and see if that 'solves' the issue. At least then we can see if it is firewall or setup. The client is behind a Cisco ASA server.

A little back ground to the project.We are moving data centres and ISP from our old provider (the 84.21.*.*) to a new DC (a 194.88.*.*) - both are public IP's. Currently all of our web based traffic is exiting through the old provider while I transfer the hosted server services from old to new DC. New routers are due to arrive to connect the 2 new connections for our new ISP, one is web based traffic only with failover to the DC, other is MPLS dedicated connection to hosted servers.

Currently I am testing the access to the web/ftp server from outside the PWAN which is where I am getting this problem.

So,

The server is behind the Sonicwalls with a public IP of 194.88.*.*, private IP is 192.168.200.*. The client is on a separate PWAN using the public IP of 84.21.*.*, private IP is 192.168.11.*.

I am going to take a look at that article tonight and see what I am missing.

You should be able to setup the server side to use specific ports for the active connections - and then forward those on your firewall, etc. Another question for you are you going to be dong Implicit or Explicit. Since you called it ftps and not ftpes I would have think your using Implicit?

You know what is a MUCH EASIER solution -- use SFTP, there is only 1 port involved (22) because its over SSH. You can change that port if you want - but its still only 1 port!! No active/passive **** with split control and data channels. Much easier to work through nat and firewalls with

Think I am gonna stick with FTPS (for now), prefer to fix this and learn a little and if I still cant get it going, will switch to SFTP.

So I have set FileZilla to use a specific port range and have requested the people who manage the server side NAT to fully open these ports to test the connection. Next I need to connect forcing passive mode so it is the client that establishes the data connection. So from that I now get this log from the client.

Yeah that 217.161 is the IP the server is telling the client to connect too. It should be the same IP you connected too for the control channel connection.

that port would be 58x256 + 153 so 15001

Look in your server settings on where its getting IP from.. Could be going out a different connection your coming into it from? You can set that IP in the same place you set the ports to use for passive.

Attached Images

Well that makes no sense then. Other than if it thinks its local connection? You could try unchecking that and see what IP gets sent back. Clearly your hard coding the IP which is different than what your seeing.

Is it possible your connecting to a different ftp server? Did you try restarting the ftp server once you made that setting?

Although we are connected via an MPLS PWAN all ftp traffic is routed through a second connection so it should always be a public IP, but definitely worth noting though.

I even got to learn something new about active and passive connections which after the telephone conversation I just had with the managers and owners is quite a feat! Apparently a data centre migration is a simple task and should only take a couple of days.........

Understanding the difference between an active or passive ftp connection is 1st step in wanting to run a ftp server, or even connect to one when NAT is involved or firewalls even if everyone is on same network or fully public connections, etc.

These days most every client is going to be behind a nat - this will change as ipv6 takes hold. So you will run into issues all the time with either active or passive connections. Most firewalls and even home routers have helper features for ftp to allow the data side of the connection - but as you learned with ftps this all changes because the helper can not view the info to either change the IP sent to public vs private and or open the firewall for the connection by working out the ports given in the pasv or port command.

This thread should be a good reference for others looking to do the same thing as well.